A critical SQL injection vulnerability, identified as CVE-2026-76904, in the open-source GeoTools Java library was reportedly exploited on the same day it was publicly disclosed, August 21, 2026. The vulnerability affects GeoTools versions starting from 30.5 and prior to versions 33.6, 34.5, and 33.6.
The flaw specifically arises when OGC Filters are executed with the PostGIS DataStore implementation, particularly through the `jsonArrayContains` function. This function, when used with PostGIS 12 or greater and a String or JSON field, fails to properly escape the `value` argument as it is written into the generated SQL query. This oversight allows for unauthenticated SQL injection.
The vulnerability carries a CVSS score of 9.8, indicating critical severity. While the Common Vulnerabilities and Exposures (CVE) record was published on August 21, 2026, evidence of exploitation also appeared on the same day, according to a commercial research firm's vulnerability catalog. A second public report of exploitation was noted on August 24, 2026, by a honeypot statistics dashboard.
GeoTools is a Java library designed to provide tools for geospatial data. The affected `jsonArrayContains` function requires PostGIS 12 or newer.
Patches addressing CVE-2026-76904 are available in GeoTools versions 33.6, 34.5, and 33.6. No known workarounds exist to fully mitigate the vulnerability, but configuring the PostGIS connection pool with limited rights is suggested as a measure to restrict the scope of potential SQL injection attacks.
